From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/steps/mail/show.inc | 27 ++++++++++++++-------------
1 files changed, 14 insertions(+), 13 deletions(-)
diff --git a/program/steps/mail/show.inc b/program/steps/mail/show.inc
index 82c8261..dbb6d21 100644
--- a/program/steps/mail/show.inc
+++ b/program/steps/mail/show.inc
@@ -59,10 +59,10 @@
$OUTPUT->set_env('permaurl', rcmail_url('show', array('_uid' => $MESSAGE->uid, '_mbox' => $mbox_name)));
$OUTPUT->set_env('delimiter', $RCMAIL->storage->get_hierarchy_delimiter());
$OUTPUT->set_env('mailbox', $mbox_name);
+ $OUTPUT->set_env('compose_extwin', $RCMAIL->config->get('compose_extwin',false));
// mimetypes supported by the browser (default settings)
- $mimetypes = $RCMAIL->config->get('client_mimetypes', 'text/plain,text/html,text/xml,image/jpeg,image/gif,image/png,image/bmp,image/tiff,application/x-javascript,application/pdf,application/x-shockwave-flash');
- $mimetypes = is_string($mimetypes) ? explode(',', $mimetypes) : (array)$mimetypes;
+ $mimetypes = (array)$RCMAIL->config->get('client_mimetypes');
// Remove unsupported types, which makes that attachment which cannot be
// displayed in a browser will be downloaded directly without displaying an overlay page
@@ -79,7 +79,7 @@
}
}
- $OUTPUT->set_env('mimetypes', $mimetypes);
+ $OUTPUT->set_env('mimetypes', array_values($mimetypes));
if ($CONFIG['drafts_mbox'])
$OUTPUT->set_env('drafts_mailbox', $CONFIG['drafts_mbox']);
@@ -97,14 +97,14 @@
$OUTPUT->set_env('skip_deleted', true);
if ($CONFIG['display_next'])
$OUTPUT->set_env('display_next', true);
- if ($MESSAGE->headers->others['list-post'])
+ if ($MESSAGE->headers->get('list-post', false))
$OUTPUT->set_env('list_post', true);
if ($CONFIG['forward_attachment'])
$OUTPUT->set_env('forward_attachment', true);
if (!$OUTPUT->ajax_call)
$OUTPUT->add_label('checkingmail', 'deletemessage', 'movemessagetotrash',
- 'movingmessage', 'deletingmessage');
+ 'movingmessage', 'deletingmessage', 'markingmessage');
// check for unset disposition notification
if ($MESSAGE->headers->mdn_to
@@ -150,10 +150,7 @@
if (sizeof($MESSAGE->attachments)) {
foreach ($MESSAGE->attachments as $attach_prop) {
- $filename = $attach_prop->filename;
- if (empty($filename) && $attach_prop->mimetype == 'text/html') {
- $filename = rcube_label('htmlmessage');
- }
+ $filename = rcmail_attachment_name($attach_prop, true);
if ($PRINT_MODE) {
$size = $RCMAIL->message_part_size($attach_prop);
@@ -161,8 +158,8 @@
}
else {
if (mb_strlen($filename) > 50) {
+ $title = $filename;
$filename = abbreviate_string($filename, 50);
- $title = $filename;
}
else {
$title = '';
@@ -258,9 +255,13 @@
if ($email) {
// @TODO: search in all address books?
$CONTACTS = $RCMAIL->get_address_book(-1, true);
- $existing = $CONTACTS->search('email', $email, true, false);
- if ($existing->count)
- return true;
+
+ if (is_object($CONTACTS)) {
+ $existing = $CONTACTS->search('email', $email, true, false);
+ if ($existing->count) {
+ return true;
+ }
+ }
}
return false;
--
Gitblit v1.9.1